Dear colleagues,

Our scanning identified your component as one of the packages using OpenSSL ENGINE API.

Engines are not FIPS compatible and corresponding API is deprecated since OpenSSL 3.0. The engine functionality we are aware of (PKCS#11, TPM) is either covered by providers maintained by Crypto Team now or will be covered soon.

We kindly ask you to implement patches or apply compiling options to eliminate the code relying on ENGINE API. Even if we don’t eliminate the ENGINE API completely for backward binary compatibility, the compilation of applications using the ENGINE API will soon become impossible.

We kindly ask you to add this work to the nearest sprint. We have a side-tag f41-build-side-86419 to build and a Copr build https://copr.fedorainfracloud.org/coprs/dbelyavs/openssl-no-engine/build/7107098/

Feel free to reach the Crypto team, Dmitry Belyavskiy, Sahana Prasad, or Clemens Lang directly if you have any problems with the necessary changes.